Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google and Mozilla are failing to support browser extension developers

armin.dev

Post reply on HN
Print view View original

121–130 of 195 posts

Re: Google and Mozilla are failing to support browser extension developers

#121

Post by AmericanChopper »

geofft wrote: post #44

> It is a regular occurrence to hear about open source developers selling their browser extensions, only for their users to be exploited later on by the new owners. ... We are witnessing the failure of browser vendors to recognize the value of our labor and the important role it plays in a healthy browser ecosystem. So this is an interesting philosophical question - the market value of the extension is the value of "…

> Is that the value of the extension developer's labor?

Labor itself has no intrinsic value at all. You don’t have to think very hard to come up with a list of things that would be laborious but not valuable. Economically speaking, the value of any product can only ever be what people are willing to pay for it. If your users aren’t willing to pay for your product in one way or another, then your only option is to sell access to your users, in one way or another.

Re: Google and Mozilla are failing to support browser extension developers

#122

Post by adrianN »

zzzcpan wrote: post #76
michaelmrose wrote: post #73

Earlier quoted context omitted.

Just never allow such a transfer force a new user to create a new name. Ensure this is part of the terms of service. Prosecute violators that is to say buyer and dev under cfaa and ensure a hefty fine is levied with prison time. Nefarious parties will find few sellers thereafter.

You forgot to mention a small detail: force every other country in the world to enforce your ridiculous laws.

Thanks to the movie industry, this is mostly a solved problem.

Re: Google and Mozilla are failing to support browser extension developers

#123

Post by zaarn »

geofft wrote: post #99
londons_explore wrote: post #71

Earlier quoted context omitted.

With many extensions having hundreds of thousands of lines of minified code, a manual check is unlikely to find anything nefarious if it's been well hidden.

IMO, extension authors should not be allowed to submit minified code alone to the extension stores for review. (Options include having standard minifiers that the extension stores run themselves, allowing extension authors to provide a .travis.yml or something where the sources to the build pipeline are themselves auditable, etc.) I can see an argument for withholding source from end users for things like paid extens…

IIRC Mozilla requires that you submit unminified code plus the minified code and how you compiled it, so they can reproduce it durign review. And they do Human Reviews using Volunteers.

Mozilla does a lot to protect users from malicious extensions, thousands times more than Google.

Re: Google and Mozilla are failing to support browser extension developers

#124

Post by pawelk »

geofft wrote: post #55
paulgb wrote: post #50

Earlier quoted context omitted.

As an extension developer who recently got one of these offers, your analysis is a good verbalization of my gut feeling on the matter. I turned it down, of course. While users may feel bad about extension developers not being compensated, I feel like the larger story here is that: - Companies are buying extensions for nefarious purposes, which presents a huge security risk. - Evidently, app stores are sufficiently ba…

Yes, agree - detecting extensions that have changed hands into someone who wants to "monetize" it and preventing those updates from getting to users definitely seems like a thing that the browser manufacturers should be doing (even if - and perhaps especially if - it lowers the apparent market value of extensions) and that the onus is on browser manufacturers / extension store operators to do so.

The fact that it has changed hands or not is irrelevant, there are valid use cases for ownership change, and there are many ways to "monetize" via malicious partner without selling the extension itself. What should be monitored are changes in the extension codebase that inject 3rd party scripts and/or modify the list of external endpoints the extension is exchanging data with.

Re: Google and Mozilla are failing to support browser extension developers

#125

Post by [deleted] »

zzzcpan wrote: post #76
michaelmrose wrote: post #73

Earlier quoted context omitted.

Just never allow such a transfer force a new user to create a new name. Ensure this is part of the terms of service. Prosecute violators that is to say buyer and dev under cfaa and ensure a hefty fine is levied with prison time. Nefarious parties will find few sellers thereafter.

You forgot to mention a small detail: force every other country in the world to enforce your ridiculous laws.

[deleted]

Re: Google and Mozilla are failing to support browser extension developers

#126

Post by Semaphor »

cameronbrown wrote: post #58
hanniabu wrote: post #56

Earlier quoted context omitted.

> the market value of the extension is the value of "monetizing" it by stuffing ads, or worse, monitoring/tracking/exfiltration, into the extension Of even worse, inserting malicious code such as a keylogger.

Even worse! A key-logger masquerading as a product! /s cough Grammarly https://techbeacon.com/security/grammarly-leaks-everything-y...

LanguageTool Plus [0] is an open source (optionally self hosted) replacement for Grammarly (a paid version is available but the free one already finds more mistakes than the free version of Grammarly did for me). Available for FF and that google browser ;)

[0]: https://languagetoolplus.com/

Re: Google and Mozilla are failing to support browser extension developers

#127

Post by feanaro »

NeedMoreTea wrote: post #114
kevingadd wrote: post #77

Earlier quoted context omitted.

I had a similar problem with Owl, it's because they typically use CSS filters to achieve dark mode. It's frustrating because it's a very bad solution but it's easy to not realize that the extension is causing the problem (especially because browsers work hard to hide it)

That does show up one area that Chrome still eclipses Firefox - the Shift Esc task manager that will usually reveal which tab or extension is cratering things. Firefox is much more opaque about memory and especially CPU use, making it far harder to pin down.

Do you know about about:performance?

Re: Google and Mozilla are failing to support browser extension developers

#128

Post by [deleted] »

asr wrote: post #13

On the one hand, this seems like a real missed opportunity by Mozilla. As Chrome reigns in extensions that conflict with Google's business model, this is a reason to use Firefox. BUT - extensions are also often the cause of a slow and frustrating Firefox experience, which then leads folks to talk about how Chrome is better-performing/faster (I've been guilty of this myself in the past). Mozilla needs to make sure Fir…

[deleted]

Re: Google and Mozilla are failing to support browser extension developers

#129

Post by feanaro »

rifung wrote: post #74
eitland wrote: post #5

Earlier quoted context omitted.

> Google would only benefit from ad/tracker blockers going away. In the long run, this might sadly be true, but I disagree for now. No way Google is doing this because of the goodness of their hearts. They do it because they haven't completely squeezed out all competitors yet. Removing or utterly crippling addons now would force users to realize what Chrome is while there still are options, meaning a huge chunk of th…

I work for Google, opinions are my own. > Sorry to all Googlers here for being so blunt, and feel free to point out one or more examples from the last few years where Google has prioritized their users above quarterly / yearly profits. No need to apologize =] An example that comes to mind is the current focus on accessibility. I think from an objective financial/engineering perspective, it's much preferable to just i…

I don't think stripping even more functionality from the already dumb Chrome on mobile is the answer. How about concentrating efforts on making it more performant instead of removing things? Firefox on Android shows it can be done.

Re: Google and Mozilla are failing to support browser extension developers

#130

Post by malka »

kibwen wrote: post #62
geofft wrote: post #55

Earlier quoted context omitted.

Yes, agree - detecting extensions that have changed hands into someone who wants to "monetize" it and preventing those updates from getting to users definitely seems like a thing that the browser manufacturers should be doing (even if - and perhaps especially if - it lowers the apparent market value of extensions) and that the onus is on browser manufacturers / extension store operators to do so.

I'm not sure how one would automatically detect such a thing as a browser extension changing hands. If you require signing extensions to make a release, there's nothing stopping a developer from selling their keys. And even without changing hands, the threat to users remains the same if the company just goes from "we'll give you $10k for your extension" to "we'll give you $10k to link this library into your extension…

You held the développer legally liable of abuses with thé extension if he did not notify mozilla or Google that he sold it
Post reply on HN